SAP BusinessObjects Explorer version 14.0.5 does not validate the user defined inputs of parameter CMS name, which consists of a host name and port number. This can be used to perform a port scan within the network range where the BusinessObject Explorer server is located. This vulnerability could be triggered as unauthenticated user.
da3b141d39bd4e752dc80ab85d3821ea612ba63b8b712c967c735c9bd4c7e6dc